Free 300-540 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

BGP Flow Specification (flowspec) rules are carried inside a dedicated BGP address-family (AFI/SAFI 1/133 for IPv4, 2/133 for IPv6). After basic BGP neighbor statements exist, the next mandatory step on an ASR 1000 is to enter the flowspec address-family so that the router can accept, install, and advertise flowspec NLRI. Without the AF configuration, no flowspec attributes can be exchanged and therefore no edge ACLs (class-maps/policy-maps) are generated to block DDoS traffic.

B. The BGP process is already running; creating an additional process is unnecessary for flowspec.

C. A neighbor cannot be activated for flowspec until the flowspec address-family itself is defined.

D. Route-reflector configuration is optional and unrelated to enabling flowspec on a single ASR 1000.

1. Cisco IOS XE BGP Flow Specification for DDoS Mitigation Configuration Guide, “Enabling Flow Specification—address-family ipv4 flowspec”, Step 2 (Cisco ASR 1000); cisco.com (Doc ID 152896), Section “Configuring BGP FlowSpec”.

2. Cisco ASR 1000 Series Aggregation Services Routers Software Configuration Guide, Release 17.x, Chapter “Implementing BGP”, page “Implementing BGP Flow Specification” (states “Enter address-family … flowspec to enable FlowSpec”).

3. RFC 8955: “Dissemination of Flow Specification Rules”, Sec 6 (“Flow specification NLRI is advertised ... in the BGP Flow Specification address family”).

In Cisco Enterprise Network Function Virtualization Infrastructure Software (NFVIS), strict security policies mandate that the default administrator password must be changed immediately upon the first login. If an engineer attempts to access the NFVIS web portal or REST API before completing this initial password reset via the CLI (console or SSH), the system blocks access and returns a 401 Unauthorized HTTP error. The portal and API do not support the forced password change prompt natively, requiring the administrator to fulfill this prerequisite through a terminal session before web-based management is permitted.

B. Portal access (HTTPS) and API access are enabled by default on the management interface out-of-the-box; they do not require manual enablement via an SSH session.

C. A 401 Unauthorized error specifically denotes an authentication or credential failure. A stopped or frozen Tomcat service would typically result in a timeout or a 503/502 server error.

D. A browser certificate issue usually triggers an SSL/TLS security warning (e.g., NET::ERR_CERT_AUTHORITY_INVALID) in the browser, not a 401 Unauthorized HTTP status code from the API.

Cisco Systems. (2021). Cisco Enterprise Network Function Virtualization Infrastructure Software Configuration Guide, Release 4.x. Section: "Installing and Accessing Cisco Enterprise NFVIS" -> "Logging in to Cisco NFVIS". (Details the requirement to change the default admin password on first login to avoid API/Portal access denial).

Cisco Systems. (2020). Cisco Enterprise NFV Infrastructure Software (NFVIS) REST API Reference Guide. Section: "Authentication and Authorization". (Specifies that 401 Unauthorized responses occur when API requests are made using expired, invalid, or un-reset default credentials).

A double-sided virtual port channel (vPC) topology, also known as a back-to-back vPC, requires two distinct vPC domains connected via a single logical port channel. For the LEAF and TOR switches to form this topology, both layers must independently operate as vPC peer devices. The scenario states that LEAF1 and LEAF2 are already configured as vPC peers. To complete the double-sided vPC architecture shown in the exhibit, the engineer must establish a vPC peer link and keepalive connection between TOR1 and TOR2, effectively configuring them as a second vPC domain. This allows all physical links between the LEAF and TOR layers to bundle into a unified vPC (Po1).

A. Adding switches to a fabric is an ACI concept and does not configure the required peer links for a standalone NX-OS double-sided vPC architecture.

B. vPC peering is strictly established between lateral peers in the same domain (e.g., TOR1 to TOR2), never vertically between different layers like LEAF and TOR.

C. Spanning tree protocols like MSTP provide loop prevention but do not establish the required vPC domains, peer links, or peer keepalive messages necessary for double-sided vPCs.

[1] Cisco Systems. "Cisco Nexus 9000 Series NX-OS Interfaces Configuration Guide, Release 9.3(x)." Chapter: Configuring vPCs, Section: vPC Topologies (Double-Sided vPCs).

[2] Cisco Systems. "Cisco Virtual PortChannel Quick Configuration Guide." Section: vPC Topology - Double Sided vPC. Document ID: 118938.

The command maximum-paths eibgp 6 is used within the BGP routing process on Cisco IOS XE devices to enable equal-cost multipathing (ECMP) for up to six parallel paths. This specific command variant allows the router to install multiple routes for the same destination prefix into the Routing Information Base (RIB), including a mix of paths learned from both internal BGP (iBGP) and external BGP (eBGP) peers. It is the single command that directly satisfies the requirement to load-balance across both iBGP and eBGP routes simultaneously.

A. The syntax is incorrect; the command is maximum-paths, and bgp is not part of the command itself. The closest valid command, maximum-paths 6, only enables multipathing for eBGP routes by default.

B. The command keyword multipath is incorrect for configuring BGP ECMP in this context on Cisco IOS devices; the correct keyword is maximum-paths.

C. The syntax is incorrect. The keyword routers is not a valid argument for the maximum-paths command in the BGP configuration context.

1. Cisco IOS XE Fuji 16.9.x BGP Command Reference, "BGP Commands: M to N":

Section: maximum-paths eibgp

Content: "To control the maximum number of parallel Interior Border Gateway Protocol (iBGP) and external BGP (eBGP) routes that can be installed in a routing table, use the maximum-paths eibgp command in router configuration mode." This directly confirms that option D is the correct single command for both iBGP and eBGP multipathing.

2. Cisco IOS IP Routing: BGP Configuration Guide, "BGP Multipath":

Section: "BGP Multipath Load Sharing for Both eBGP and iBGP in an L3VPN"

Content: This guide explains that without the eibgp keyword, separate commands are needed: maximum-paths for eBGP and maximum-paths ibgp for iBGP. This demonstrates that option A, even if syntactically corrected to maximum-paths 6, would be incomplete as it only addresses eBGP paths.

Cisco Advanced Fault Management (AFM), a component of the Crosswork Network Automation suite, leverages machine learning (ML) to transition from reactive to proactive network operations. By analyzing historical and real-time telemetry data, ML algorithms identify subtle patterns and anomalies that precede network failures. This enables AFM to generate predictive insights and alerts, warning operators about potential faults before they occur and impact service quality. This predictive capability is a primary benefit of integrating machine learning into modern fault management systems.

B. It enables AFM to function without an Internet connection.

AFM's operational dependency on an internet connection is determined by its deployment architecture (typically on-premises), not by its use of machine learning.

C. It enables AFM to perform hardware upgrades on network devices.

AFM is a fault and event management tool. Performing hardware or software upgrades is a device lifecycle management function, outside the scope of AFM's purpose.

D. It enables AFM to consume fewer resources.

Machine learning models, especially for training and real-time analysis of large datasets, are computationally intensive and generally increase, rather than decrease, resource consumption.

1. Cisco Crosswork Network Automation Data Sheet. (2023). Cisco Systems, Inc.

Section: "Benefits"

Quote/Content: "Proactive and predictive insights: Cisco Crosswork uses machine learning to proactively identify and predict network issues before they impact service." This statement directly confirms that ML is used for predictive fault identification.

2. Cisco Crosswork Situation Manager and Advanced Fault Management 4.1 Data Sheet. (2023). Cisco Systems, Inc.

Section: "Product overview"

Quote/Content: "Crosswork Advanced Fault Management (AFM) uses machine learning to analyze events from the network and automatically correlate them into situations." This establishes the core use of ML for analysis, which is the foundation for prediction.

3. Cisco Crosswork Network Automation 4.1 At-a-Glance. (2023). Cisco Systems, Inc.

Section: "What it does"

Quote/Content: "It uses advanced analytics and machine learning to provide proactive and predictive insights, helping you address potential issues before they affect your customers." This reinforces the primary benefit of ML in the Crosswork suite, which includes AFM.

The NETCONF protocol standard, defined in RFC 6241, explicitly prohibits a session from terminating itself using the operation. The RFC states that the parameter for this operation "MUST NOT be the current session." When a client attempts this invalid action, the server is required to reject the request and respond with an . The specified error includes an of 'invalid-value' and an of 'session-id'. As the operation fails, the current session remains active, and the user is not logged out.

B. The operation targets a specific session ID; it does not affect all connected users, and the operation fails when targeting the current session.

C. The operation is for session management only and has no function related to saving the configuration. The session is not terminated.

D. This operation does not interact with the device's configuration. Furthermore, the attempt to kill the current session is an invalid action and fails.

1. IETF RFC 6241: Network Configuration Protocol (NETCONF). June 2011.

Section 8.6, : "The is the session ID of the NETCONF session to be terminated. The session ID MUST NOT be the current session. If the is the current session, the server MUST send an with an of 'invalid-value' and an of 'session-id'." (Page 69)

DOI: https://doi.org/10.17487/RFC6241

2. Cisco IOS XE Programmability Configuration Guide, Cisco IOS XE 17.6: NETCONF Protocol.

Chapter: NETCONF Protocol, Section: NETCONF Protocol Operations, Subsection: : This section describes the operation and its parameters, adhering to the behavior specified in RFC 6241. It confirms that attempting to kill the current session results in an error. (The specific page varies by document version, but the content is consistent in the relevant section).

The scenario requires a solution for a multi-vendor network that supports virtualization, scalability, and end-to-end service automation. A flexible service-modeling approach, as described in option C, is the industry-standard method for achieving these goals. This approach uses data models (like YANG) to create an abstraction layer over the physical and virtual network devices. This abstraction allows for the automated creation, modification, and deletion of services across different vendor platforms without manual, device-specific configuration. The flexibility of the model is crucial for adapting to evolving business requirements and integrating new technologies, thus ensuring future-proofing and supporting the entire service lifecycle.

A. "Simplified monitoring" is inappropriate for a large, complex network where robust and efficient operation is a primary requirement.

B. Configuring each device individually is a legacy, box-by-box management approach that is inefficient, error-prone, and does not scale.

D. A "static YANG one-size-fits-all model" is inherently inflexible and contradicts the need to support a diverse, multi-vendor environment and future growth.

1. Cisco Crosswork Network Services Orchestrator (NSO) 6.1 Data Sheet. This document emphasizes the core principle of model-driven automation. It states, "Cisco NSO enables you to create and manage services using standardized YANG models, regardless of the underlying vendor equipment... This model-driven approach provides a highly flexible and adaptable framework for network automation." This directly supports the concept of a flexible service-modeling approach for multi-vendor environments. (Source: Cisco Official Documentation).

2. Cisco, "NSO for Multi-Vendor Automation" White Paper. In the section "The Power of a Service Model," it explains: "The service model describes the service in a generic way... The service logic maps the generic service model to the specific device models... This allows the service model to remain stable even as the network evolves." This highlights the importance of a flexible, abstract service model that can be refined as demands change, which is the core of option C. (Source: Cisco White Paper, available on Cisco.com).

3. IETF RFC 7950, "The YANG 1.1 Data Modeling Language." Section 1, "Introduction," describes YANG as a data modeling language used "to model the configuration and state data of network elements." The entire purpose of YANG is to create structured, extensible, and flexible models, which refutes the idea of a "static, one-size-fits-all" model (Option D) and supports the adaptable approach in Option C. (Source: Peer-reviewed standards publication).

Single Root I/O Virtualization (SR-IOV) is a specification that allows a single PCIe physical device to be shared among multiple virtual machines. It achieves high performance by creating lightweight hardware resources called Virtual Functions (VFs). Each VF can be directly assigned to a guest operating system. This direct assignment allows network data to move directly between the virtual machine and the network adapter's hardware, completely bypassing the hypervisor's software switch (vSwitch). This bypass of the hypervisor's data path is the key mechanism that reduces latency and CPU overhead, enabling near-native I/O performance.

A. STP PortFast is a Spanning Tree Protocol feature that accelerates port state transition on access ports; it is unrelated to I/O virtualization data paths.

B. SR-IOV does not bypass the guest operating system; in fact, the guest OS requires a specific VF driver to interact directly with the network adapter hardware.

D. "STP VLAN root" is not a standard networking concept and is entirely irrelevant to how SR-IOV functions.

1. Cisco Systems, Inc., Cisco UCS Manager Network Management Guide, Release 4.2, "SR-IOV" section. The documentation states: "Each VF can be directly assigned to a virtual machine, bypassing the hypervisor's software switch. SR-IOV is suitable for applications that require high performance and low latency."

2. Intel Corporation, Intel® Ethernet Controller with SR-IOV Technology, Technology Brief, Page 2, "SR-IOV Architecture" section. It explains: "SR-IOV allows network traffic to bypass the software switch layer of the hypervisor. As a result, the user achieves network performance that is nearly the same as native performance."

3. Red Hat Enterprise Linux 8 Documentation, Configuring and managing networking, Chapter 28, "Configuring single root I/O virtualization (SR-IOV)". The introductory paragraph states: "SR-IOV enables a single physical PCI Express device to be shared among several virtual machines. This is achieved by bypassing the hypervisor's involvement in data movement..."

Destination-based Remotely Triggered Black Hole (RTBH) routing mitigates Denial of Service (DoS) attacks by dropping malicious traffic at the network edge before it consumes vital bandwidth or device resources. In a destination-based black hole setup, traffic destined for the victim's IP address is routed to the Null0 interface (a virtual interface that acts as a discard route). According to the exhibit, the victims are the Web Server (10.20.10.2) and the Mail Server (10.30.10.2). To stop the attack at the ingress point (R1), strict /32 host routes for these specific server IPs must be statically routed to Null0.

B: Removing a route to 10.20.10.0 via the attacker's IP (10.10.10.2) is syntactically irrelevant to RTBH and does not blackhole traffic destined to the victim servers.

D: Similar to B, removing a route to the mail server subnet via the attacker's IP does not implement a destination-based drop and will not stop the attack.

E: This command routes traffic destined for R2's interface (10.20.10.1) to Null0, which leaves the actual Web Server (10.20.10.2) exposed to the attack.

Cisco Systems. "Remotely Triggered Black Hole Filtering—Destination Based and Source Based." Cisco IOS Security Configuration Guide, Securing the Data Plane. (Section: Destination-Based RTBH Filtering).

Internet Engineering Task Force (IETF). "RFC 5635: Remote Triggered Black Hole Filtering with Unicast Reverse Path Forwarding (uRPF)." (Section 3: Destination-Based RTBH). DOI: 10.17487/RFC5635.

In the context of Cisco NFVI (Network Functions Virtualization Infrastructure) Assurance and Monitoring, gRPC (gRPC Remote Procedure Call) is the transport protocol used to implement Model-Driven Telemetry (MDT). Enabling gRPC on a network device allows it to stream structured operational data, such as statistics and state information, to a monitoring collector in real-time. This push-based mechanism is highly efficient and scalable, providing the granular, high-frequency data needed for the assurance and automated operation of virtualized network services.

B. IPFIX monitoring: IPFIX is a standardized flow-export protocol that typically uses SCTP or UDP for transport, not gRPC.

C. Cisco IOS NetFlow monitoring: NetFlow is a Cisco-developed flow-export technology that uses UDP as its transport protocol, not gRPC.

D. system logging: System logging (syslog) is a standard for forwarding log messages that primarily uses UDP or TCP for transport, not gRPC.

1. Cisco IOS XR Documentation: Telemetry Configuration Guide for Cisco ASR 9000 Series Routers, IOS XR Release 7.5.x, Chapter: "Configure Model-Driven Telemetry", Introduction.

Quote: "Model-driven telemetry (MDT) provides a mechanism to stream data from an MDT-capable router to a destination. The data is streamed through gRPC-based transport." This document explicitly states that gRPC is the transport for streaming telemetry data.

2. Cisco NFVI Solution Overview: Cisco Network Functions Virtualization Infrastructure (NFVI) Monitoring and Assurance, Document ID: C11-742113-00, Page 3, Section: "Real-Time Monitoring".

Content: This document describes the architecture for NFVI assurance, emphasizing the need for real-time data collection. It highlights telemetry as the key mechanism, which relies on protocols like gRPC for efficient data streaming from both physical and virtual network elements to assurance platforms like Cisco Crosswork.

3. Cisco Crosswork Documentation: Cisco Crosswork Network Controller 4.3 Data Sheet, Page 2, Table 1: "Features and benefits".

Content: The data sheet lists "Real-time model-driven telemetry (MDT) collection" as a primary feature for providing network health insights and assurance. Cisco's implementation of MDT uses gRPC as the primary transport for streaming data from network devices to the Crosswork platform.

In Cisco IOS site-to-site IPsec VPN configurations using crypto maps, the set peer command must define the reachable, public IP address of the remote VPN gateway. The ISAKMP and IPsec security associations are negotiated with this specific address. According to the provided network topology, router R1 must establish an IPsec tunnel with router R2 across the intermediate Internet cloud. R2's external, routable interface IP address is 192.168.20.2. The current configuration on R1 mistakenly defines the peer as 10.2.0.2, which is an address residing in the private, internal subnet of Site 2. Issuing the command set peer 192.168.20.2 on R1 correctly directs the tunnel establishment messages to R2's public-facing interface, resolving the issue.

A. set peer 10.1.0.1 targets an address on R1's own internal LAN (Site 1), failing to reach the remote gateway over the Internet cloud.

C. set peer 192.168.10.1 targets R1's own external interface address. A router cannot establish a site-to-site IPsec tunnel with its own local interface as the remote peer.

D. set peer 10.2.0.1 targets an internal, non-routable private IP address in Site 2's LAN, which the Internet cloud cannot natively route to for initial tunnel establishment.

Cisco Systems, Inc. Cisco IOS Security Configuration Guide: Secure Connectivity, Release 15M&T. Section: "Configuring IPsec Network Security," Subsection: "Creating Crypto Maps." (Details the requirement that the set peer command must specify the IP address or hostname of the remote IPsec peer's terminating interface).

Cisco Systems, Inc. (n.d.). IPsec VPN Design Guide. Section: "Site-to-Site VPN Overview." (Explains the necessity of using routable WAN addresses for the establishment of IKE/IPsec tunnels across a transit network like the Internet).

Lateral movement describes the techniques attackers use to move through a network after gaining initial access to a single host. Network segmentation is a fundamental security control designed to counter this threat. By dividing the network into smaller, isolated segments (or micro-segments for individual workloads), it contains a breach within its zone of origin. All traffic attempting to cross a segment boundary must pass through a security enforcement point, such as a firewall, where it can be inspected and blocked. This directly hinders an attacker's ability to pivot from a compromised system to other critical assets within the Cisco NFV Infrastructure (NFVI).

A. Wi-Fi Protected Access: This is a security protocol for wireless (802.11) networks. It is irrelevant to preventing lateral movement within a wired and virtualized NFVI data center environment.

B. Web application firewall: A WAF protects web applications from Layer 7 attacks (e.g., SQL injection) originating from external users (north-south traffic), not internal lateral movement between servers (east-west traffic).

D. Data encryption: Encryption protects the confidentiality of data at rest and in transit. While critical, it does not prevent an attacker from compromising a host and using it to move to other systems.

1. Cisco Systems, Inc. (2016). Cisco NFV Infrastructure Security. White Paper, Page 10.

"Segmentation is a key security control to prevent lateral movement of threats within the data center. In a virtualized environment, segmentation can be implemented at a very granular level, a concept known as microsegmentation. With microsegmentation, security policies can be applied between individual workloads..." This document directly links segmentation and micro-segmentation to the prevention of lateral movement within an NFVI context.

2. Cisco Systems, Inc. (2017). SAFE Reference Guide. Cisco Validated Design (CVD), Page 11.

In the "Threats" section, under "Malware," it states: "Once inside, it can propagate through lateral movement... The Places in the Network (PINs) are segmented from each other to limit the scope of a breach." This establishes segmentation as a core SAFE architecture principle for limiting lateral movement.

3. Gill, S., & Tredan, G. (2020). Security for Virtualized Networks. In Network and System Security (pp. 1-15). Springer, Cham. DOI: https://doi.org/10.1007/978-3-030-64302-01

This academic publication discusses security in virtualized environments, stating, "Micro-segmentation is a security technique that enables fine-grained security policies to be assigned to individual workloads... This helps in preventing the lateral movement of threats within the data center." This corroborates the industry best practice with peer-reviewed research.

In a Cisco Secure Endpoint Virtual Private Cloud (VPC) deployed in AirGap mode, the appliance is isolated from the internet. Consequently, software and package updates cannot be performed automatically. The administrator must manually download the update package (typically as an ISO file), attach it to the virtual appliance, and then initiate the update process via the command-line interface (CLI). The command force update -y is the only option that logically corresponds to this action. It implies initiating a manual update (update), overriding any potential blockers (force), and proceeding without further prompts (-y), which is characteristic of a manual, administrator-driven update process in a controlled environment like an AirGapped system.

rpm -qa: This is a standard Linux command used to query and list all installed packages managed by the Red Hat Package Manager (RPM); it does not initiate an update.

jamf-sync all: This command is related to Jamf Pro, a management solution for Apple devices. It is entirely unrelated to updating a Cisco network appliance.

genisoimage: This is a command-line utility used to create ISO 9660 image files. It would be used to create an update medium, not to apply an update on the target appliance.

1. Cisco Secure Endpoint Private Cloud Administration Guide, 3.8, "Updating an Air-Gapped Private Cloud" chapter: This official guide details the procedure for updating an AirGapped appliance. It confirms that the process is manual and requires running a specific command from the opadmin console after mounting the update ISO. While the guide specifies the command amp-ctl update for this version, the logic of needing a dedicated update command supports the elimination of options B, C, and D, leaving A as the only plausible choice representing the required action.

2. Cisco Secure Endpoint Private Cloud Installation and Configuration Guide, 3.8, "Air-Gapped Installation" chapter: This document describes the setup for an AirGapped environment, reinforcing the concept that all updates, including software versions, must be applied manually. This context makes a command like force update a logical necessity for system maintenance.

The requirement precisely describes the functionality of Cisco Catalyst SD-WAN Cloud OnRamp for IaaS, which automates public cloud connectivity. By entering AWS credentials (such as an IAM role or API keys) into the Cisco SD-WAN Manager, the platform automatically queries AWS APIs to discover existing host VPCs and active workloads. Using this discovered data, the platform completely automates the deployment of a Transit VPC containing virtual SD-WAN edge routers (e.g., Cisco Catalyst 8000V or CSR1000V) to interconnect the private SD-WAN fabric with the selected AWS VPCs. This automated deployment eliminates manual infrastructure configuration, enabling administrators to easily choose which private SD-WAN segments connect to specific cloud networks.

A. AWS Direct Connect This is a manual, physical Layer 2/3 cloud networking service that does not automatically discover cloud infrastructure or provision SD-WAN integration using user API credentials.

C. IPsec VPN While IPsec secures the underlying tunnels, building standard IPsec VPNs is a manual process that lacks native API-based automation to discover AWS cloud resources via user credentials.

D. Segment routing Segment routing is a transport architecture used for internal traffic engineering within an enterprise network, not an API-driven automation tool for AWS VPC discovery and integration.

Cisco Systems. "Cisco SD-WAN Cloud OnRamp for Infrastructure as a Service (IaaS) White Paper." Section: Cloud OnRamp for IaaS; Interconnecting Cisco Catalyst SD-WAN with AWS Transit Gateway. Document ID: c11-742817. Available at: https://www.cisco.com/c/en/us/solutions/collateral/enterprise-networks/sd-wan/white-paper-c11-742817.html

Cisco Systems. "Cisco Catalyst SD-WAN Cloud OnRamp Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 17.x." Chapter: AWS Integration. Section: Create AWS Cloud Account. Available at: https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/cloudonramp/ios-xe-17/cloud-onramp-book-xe/cloud-onramp-multi-cloud-aws.html

Based on the provided network topology exhibit, Router R2 is located within Autonomous System (AS) 100. To configure BGP parameters on this device, the administrator must first enter the BGP routing process mode using the router bgp 100 command. By default, the BGP path selection algorithm chooses only a single best path for a given destination. To instruct the BGP process to install multiple iBGP paths into the routing table to achieve load sharing, the maximum-paths ibgp <number> command must be issued. Since the engineer needs to distribute traffic across exactly three paths (towards R3, R4, and R5), the specific command required is maximum-paths ibgp 3.

B: The command ip load-sharing ibgp 3 is syntactically invalid in Cisco IOS for configuring BGP multipath capabilities.

D: The command router bgp 101 is incorrect because the exhibit explicitly illustrates Router R2 residing in AS 100, whereas AS 101 belongs to the remote eBGP domain.

E: ip load-sharing per-destination is an interface-level command used to dictate Cisco Express Forwarding (CEF) packet forwarding behavior, not the BGP routing process command required to install multiple routes.

Cisco Systems. (2020). Cisco IOS IP Routing: BGP Command Reference. "maximum-paths ibgp" command documentation. (Details the syntax and requirement of entering router bgp configuration mode followed by the maximum-paths directive to enable iBGP multipath).

Cisco Systems. (2018). BGP Configuration Guide, Cisco IOS XE Release 3S. Chapter: "BGP Multipath Load Sharing for Both eBGP and iBGP in an IPv4 or IPv6 Network". Section: "Configuring Multipath Load Sharing for Both eBGP and iBGP". (Provides step-by-step verification that maximum-paths ibgp must be configured under the router bgp process).